Starting with OWASP I am learning how session fixation attacks work.
This is the scenario: The attacker has the session ID generated by the server (by logging in for example), and sends a hyperlink with the same session id in it to the victim. Now when the victim logs into it, the attacker gets control over his account.
My doubts are:
- When the attacker uses an already existing session ID, doesn't the server know that the session id has already been taken by the attacker?
- When the victim logs into the website, what can an attacker do with it? Any examples?